IP blocked by configserver.com's firewall? Unable to update.

[xphantom]

We have just received a brand new server from singlehop, and when attempting to install CSF etc, we apparently are blocked by the configserver's actual firewall. Our IP range includes 198.20.70.XXX

I have had to edit my evidence below due to:
"You are not currently authorized to post url links, please remove or rename:"

Code: Select all

traceroute to configserver.XXX (85.13.195.235), 30 hops max, 60 byte packets
 2  (108.178.63.189)  1.108 ms  1.169 ms  1.167 ms
 3  (108.178.63.245)  0.517 ms  0.754 ms  0.815 ms
 4  (62.115.38.97)  0.336 ms   (62.115.38.93)  10.277 ms  (62.115.38.97)  10.555 ms
 5  (80.91.245.77)  9.434 ms X  (62.115.136.216)  9.624 ms  (80.91.245.77)  9.452 ms
 6  (213.248.101.50)  9.912 ms  9.842 ms  10.101 ms
 7  (129.250.5.69)  38.279 ms  9.810 ms  9.772 ms
 8  (129.250.3.54)  66.959 ms  66.349 ms  72.990 ms
 9  (129.250.4.5)  73.100 ms  72.538 ms
 *
10 (129.250.2.145)  152.252 ms  141.674 ms  149.402 ms
11  (129.250.4.125)  141.478 ms  151.032 ms  152.659 ms
12  (129.250.5.197)  165.848 ms  153.057 ms  168.318 ms
13  (129.250.5.41)  169.933 ms  173.193 ms  172.399 ms
14  213.130.48.242 (213.130.48.242)  168.050 ms  176.450 ms  177.139 ms
15  (89.187.93.135)  188.438 ms  173.072 ms  182.528 ms
16  * * *
17  * * *
18  * * *

Thanks.

[86brown]

I'm also experiencing this issue, although this is my own server in my own datacenter.

Installed minimal install of CentOS 6.5, then continued by installing OpenVZ. Created a container, installed cPanel, followed by csf. All default settings, no changes. Tried this on 2 separate servers, both with the same result.

CSF does work, but blocks ALL traffic. Not sure how to fix it. Basically, if you add an IP to csf.allow, it is allowed through.

I've tried all of the help listed in the sticky posts, one particular one has 3 broken links in it for VPS providers but can't get to the info.

One thing I did notice however, is that if you don't disable OR flush & save iptables rules before booting into OpenVZ kernel after installation, you won't get access to your box afterwards. Had to go to DC and disable iptables on the HW node to regain access.

Also tried setting various settings in /etc/csf/csf.conf such as directed by several sites while searching through Google, such as the ETH device to venet+, setting conntrack mode to 1, adding inital rules in csfpre or csfpost...

Any help on this would be greatly appreciated, very difficult to get a new server going, I don't remember it being this difficult on the 30+ other servers I've configured in the past.

No fatal errors in csftest:

Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing ipt_owner/xt_owner...OK
Testing iptable_nat/ipt_REDIRECT...FAILED [Error: FATAL: Module ip_tables not found.] - Required for MESSENGER feature
Testing iptable_nat/ipt_DNAT...FAILED [Error: FATAL: Module ip_tables not found.] - Required for csf.redirect feature

RESULT: csf will function on this server but some features will not work due to some missing iptables modules [2]

[xphantom]

86brown, that would be an unrelated issue to mine. I cannot reach configserver com, the actual website, from my server to update. All other traffic works fine.

It sounds like your issue is due to your main node missing the iptable_nat modules. You do have fatal errors there. Are they properly loaded in your configuration? You may have to do the following on your openVZ container:

http://www.webhostingtalk (INSERT COM) /showpost.php?s=d69cf65a2d74a1c43c1ae03dff6b0470&p=6597804&postcount=3

Again these are issued on the main node, not within the VPS. You have to stop/restart the container also after saving these variables.

Thanks.

[86brown]

Thanks for your reply I'll create a different thread for my issue, since its unrelated (I initally thought it was), my apologies wasn't trying to hijack the thread heheh!

--

Issue is I've tried all that. I have VZ nodes in several datacenters, physically installed personally and done all the setups, never had this issue before. Really can't discern anything different I've done other than use a more recent version of CentOS, although all get updated so it shouldn't matter. Only thing else that may be different is I'm using a Layer3 switch there, with IP routing enabled, but thats irrelevant really I would think.

I have a working server with a different kernel, which I'm updating/rebooting tonight to confirm and see if it remains working on that one, but all of the config options are quite the same between each other.